Enforce and document file hash requirement for MCPB packages (#368)

## Summary
Implements mandatory file hash validation for MCPB (MCP Bundle) packages
to ensure file integrity and security.

## Changes
- **Validator enforcement**: MCPB packages now require `file_sha256`
field at publish time
- **Test coverage**: Updated all MCPB test cases to include valid
SHA-256 hashes
- **Documentation**: Updated publisher guide and schema to reflect hash
requirement
- **Error handling**: Clear error message when hash is missing

## Security Impact
This ensures the complete security workflow for MCPB packages:
1. Authors generate and provide SHA-256 hashes when publishing
2. Registry validates hash is present (but doesn't verify content)
3. MCP clients validate hash matches downloaded file before installation

Fixes #351

internal/api/handlers/v0/publish_integration_test.go

@@ -234,6 +234,7 @@ func TestPublishIntegration(t *testing.T) {
 					RegistryType: model.RegistryTypeMCPB,
 					Identifier:   "github.com/domdomegg/airtable-mcp-server/releases/download/v1.7.2/airtable-mcp-server.mcpb",
 					Version:      "1.7.2",
+					FileSHA256:   "fe333e598595000ae021bd27117db32ec69af6987f507ba7a63c90638ff633ce",
 					Transport: model.Transport{
 						Type: model.TransportTypeStdio,
 					},

internal/api/handlers/v0/publish_registry_validation_test.go

@@ -98,6 +98,7 @@ func TestPublishRegistryValidation(t *testing.T) {
 					RegistryType: model.RegistryTypeMCPB,
 					Identifier:   "https://github.com/microsoft/playwright-mcp/releases/download/v0.0.36/playwright-mcp-extension-v0.0.36.zip",
 					Version:      "0.0.36",
+					FileSHA256:   "fe333e598595000ae021bd27117db32ec69af6987f507ba7a63c90638ff633ce",
 					Transport: model.Transport{
 						Type: model.TransportTypeStdio,
 					},
@@ -149,6 +150,7 @@ func TestPublishRegistryValidation(t *testing.T) {
 					RegistryType: model.RegistryTypeMCPB,
 					Identifier:   "https://github.com/microsoft/playwright-mcp/releases/download/v0.0.36/playwright-mcp-extension-v0.0.36.zip",
 					Version:      "1.0.0",
+					FileSHA256:   "fe333e598595000ae021bd27117db32ec69af6987f507ba7a63c90638ff633ce",
 					Transport: model.Transport{
 						Type: model.TransportTypeStdio,
 					},
@@ -209,6 +211,7 @@ func TestPublishRegistryValidation(t *testing.T) {
 					RegistryType: model.RegistryTypeMCPB,
 					Identifier:   "https://github.com/microsoft/playwright-mcp/releases/download/v0.0.36/playwright-mcp-extension-v0.0.36.zip",
 					Version:      "1.0.0",
+					FileSHA256:   "fe333e598595000ae021bd27117db32ec69af6987f507ba7a63c90638ff633ce",
 					Transport: model.Transport{
 						Type: model.TransportTypeStdio,
 					},

internal/api/handlers/v0/publish_test.go

@@ -222,6 +222,7 @@ func TestPublishEndpoint(t *testing.T) {
 						RegistryType: model.RegistryTypeMCPB,
 						Identifier:   "https://github.com/example/server/releases/download/v1.0.0/server.tar.gz",
 						Version:      "1.0.0",
+						FileSHA256:   "fe333e598595000ae021bd27117db32ec69af6987f507ba7a63c90638ff633ce",
 						Transport: model.Transport{
 							Type: model.TransportTypeStdio,
 						},